Plan Phase 5: SuperTokens client integration (v1.9) - #12
Open
NeverEndingCode wants to merge 1 commit into
Open
Conversation
Written at the end of a session so the next one can start cold. Deliberately a plan and not a half-built implementation - partial frontend auth is worse than none. Task 1 needs no code at all: drive the SuperTokens login by hand with two curl calls against production dual, and check user.id comes back as github:37058311 rather than a UUID. That is the first time the signInUp mapping ever runs for real - it is exhaustively unit-tested, including the ordering guarantee, but dual does not exercise it because the client still logs in through passport. If Task 1 fails, everything after it is premature. Records the decision to hand-roll the three fetch calls rather than adopt supertokens-web-js, whose signOut() targets the /auth/signout that v1.8 deliberately removed, and which pulls in more surface than the allowlist permits. Also carries forward the constraints a fresh session would otherwise have to rediscover: users.id never changes, nobody gets logged out, the allowlist IS the SuperTokens HTTP surface, signinup takes only the redirect flow, and the five documents that currently say supertokens mode is unusable and will need un-blocking together. Docs only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs only. Written at the end of a session so the next one can start cold.
Deliberately a plan rather than a half-built implementation — partial frontend auth is worse than none.
Task 1 needs no code: drive the SuperTokens login by hand with two curl calls against production
dual, and checkuser.idcomes back asgithub:37058311rather than a UUID. That is the first time thesignInUpmapping ever runs for real — it is exhaustively unit-tested, butdualdoes not exercise it, because the client still logs in through passport. If Task 1 fails, everything after it is premature.Records the decision to hand-roll the three fetch calls rather than adopt
supertokens-web-js, whosesignOut()targets the/auth/signoutv1.8 deliberately removed.Also carries forward the constraints a fresh session would otherwise rediscover the hard way, and lists the five documents that currently say
supertokensmode is unusable and must be un-blocked together.🤖 Generated with Claude Code